CVE-2026-85014

A denial-of-service flaw in undici's experimental WebSocketStream client allows a remote WebSocket server to crash the entire Node.js process simply by closing the TCP connection without performing a WebSocket close handshake. On an unclean close, undici's internal socket-close handler unconditionally aborts the writable stream while the application still holds a writer on it; per the WHATWG Streams standard, aborting a locked writable returns a promise that rejects with a TypeError, and because that rejection is never observed, Node.js's default unhandled-rejection behavior terminates the process. The attacker gains only a crash (availability impact, CVSS 7.5) with no authentication required and no application mistake needed — any client that connects to a malicious or compromised server can be killed with a single abrupt disconnect. Affected software is the Node.js undici library from 7.0.0 through 7.29.1 and from 8.0.0 through 8.10.2, though only deployments that actually use the experimental WebSocketStream API hit the vulnerable code path. No public proof-of-concept or in-the-wild exploitation is known, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Upgrade undici to the fixed releases named in the advisory (7.29.1 / 8.10.2, or the latest patch available in your branch), including auditing your dependency tree and any separately pinned undici copies. If you cannot patch immediately, avoid the experimental WebSocketStream API in favor of a stable WebSocket client, and consider registering a process-level 'unhandledRejection' handler to convert the crash into a logged error rather than a process exit. Check whether any client code connects via WebSocketStream to servers you do not fully control, since those endpoints can crash your service at will.